Here are some examples of configuration you can obtain by configuring security in Sonar:

Secure a Sonar instance by forcing login prior to access to any page

Make a given project non accessible to anonymous

Allow access to source code (Code Viewer) to a given set of users

Restrict access to a project to a given group of users

Define who can administer a project (setting exclusion patterns, tuning plugins configuration for that project, etc.)

Define who can administer a Sonar instance

Built-in Security

Authentication

Default Admin Credentials

When installing Sonar, a unique user gets created:

Login: admin

Password: admin

Add Users

A user is a set of basic information: login, password, name and email.

To create a new user, go to Setting > Security > Users > Add new user:

Change my Password

Log in and click on your name (top right of the screen).

LDAP plugin

Icon

When the LDAP plugin is installed and activated, it is no longer possible for users to change their password. Then, only system administrators can do so through Settings > Security > Users.

Authorization

The way authorization is implemented in Sonar is pretty standard. It is possible to create as many users and groups of users as required in the system. The users can then be attache (or not) to (multiple) groups. Groups and / or users are then given (multiple) roles. The roles grant access to projects, services and functionalities in Sonar.

Groups

Overview

A group is a set of users.

To create a new group, go to Settings > Security > Groups > Add new group:

To add/remove users to/from a group:

Special groups

Two groups have a special meaning in Sonar:

Anyone is a group that exists in the system, but that cannot be managed. Every user belongs to this group.

sonar-users is the group to which users are automatically added. This group can be changed through the Global Security Settings ('sonar.defaultGroup' property).

Roles

Overview

There are 5 roles in Sonar, 2 are global, the 3 others are defined at project level:

Global roles:

System Administrators have the ability to perform all administration tasks on the Sonar instance like global configuration, customization of the home page, etc.

Quality Profile Administrators have the ability to perform any changes on quality profiles (since Sonar 3.6)

Project roles:

Administrators have the ability to perform administration tasks for a project by accessing its settings

Users have the ability to browse the measures of a project

Code viewers have the ability to view the source code of a project

Note that roles are not cumulative. For instance, if you want to be able to administer the project, browse the measures and browse the source code, you have to be given the three roles: Administrator, User and Code Viewer.

Default project roles

It is possible to configure the system so that when a new project is created, some users/groups are automatically granted roles on this project.

In the example below, once a new project has been created:

All the users in the sonar-administrators group can administrate (Administrators), access the project (Users) and browse the source code (Code viewers).

The myAuditor user can access access the project (Users) and browse the source code (Code viewers).

Security Settings

Default user group: any new user created will automatically join this group.

Force user authentication: this is really the first question that should be answered when setting the security strategy in Sonar. Can anybody browse the Sonar instance or do you need to be authenticated?

Allow users to sign up online: this means that anybody can access a form to create himself an account in the system. Note that after filling up the form, the user should log in.

Import sources: if set to false, source code will not be accessible for any user, to restrict access to source code for some users only, see Code viewers role.

Delegation to an External System

In order to leverage existing enterprise infrastructure, Sonar provides the capability to delegate authentication and authorization to external systems through plugins:

Settings Encryption

Encryption is mostly used to remove clear passwords from settings, ie the database or SCM credentials. The implemented solution is based on a symetric key algorithm. The keypoint is that the secret key is stored in a secured file on disk. This file must be readable and owned by only the system account that executes the different Java process (Maven Plugin, Ant task, continuous integration server, sonar server, ...).

The algorithm is AES 128 bits. Note that 256 bits cipher is not used because it's not supported by default on all Java Virtual Machines (see this article).

How to generate the secret key

An unique secret key is shared between all the parts of the Sonar infrastructure (server and code analyzers). It is generated online with the administration console (Configuration > General Settings > Encryption). Follow the instructions to store the key in a secured file on the server, generally in ~/.sonar/sonar-secret.txt. If the file is elsewhere, then declare its path with the property sonar.secretKeyPath in conf/sonar.properties and restart the server.

If you want to encrypt properties that are used by code analyzers, then copy the file on all the required machines. Use the same property sonar.secretKeyPath to change the default location.

Example of sonar-secret.txt

When this is done, you can start encrypting settings.

How to encrypt settings

The administration console used to generate the secret key allows also to encrypt text values. Simply copy the encrypted texts in the appropriate locations.

Example for Maven settings.xml

Example for conf/sonar.properties

FAQ

I have locked myself out

There is currently nothing that stops you removing from every user and every group the global administrator role. the global administrator role. You then have no other solution than make an manual update in the Sonar database to get back in control.

I have lost the admin password

In case you lost the admin password of your Sonar instance, you can reset it by running the following update statement :